OFFENSIVE SECURITY
TRAINING FOR THE
MODERN THREAT
LANDSCAPE
The course that teaches coders to think like attackers — and attackers to code like engineers. No hand-holding. No toy examples. Real tradecraft, first principles, working tools.
These are the tools the course is built around. Each one is a working weapon — not a tutorial wrapper. Source repos are private. Buyers get the encrypted 7z archive. This is the public record.
Windows recon framework — WMI enumeration, Active Directory mapping, privilege audit, CWE vulnerability scanner. The reconnaissance layer of the full kill chain.
HWBP AMSI+ETW bypass via DR0/DR7+VEH. Zero memory patching. 26 binaries CLEAN across Kaspersky Premium + Defender + MalwareBytes simultaneously. MSRC VULN-195458.
Zero-width Unicode steganographic encoder. 16-char ZW alphabet. Shellcode hidden inside any text — invisible to AV entropy scanning. Exfil via Discord CDN, S3, any image host.
TCP reverse shell with 8-layer evasion stack: XOR obfuscation, dynamic API resolution, anti-sandbox gates, PE header stomp, ISUN auth token, sleep jitter, HWBP AMSI+ETW bypass.
Published vulnerability research. HWBP Tamper Protection bypass, TOCTOU quarantine race condition. MSRC VULN-195458 disclosed. MITRE CVE submissions #49 and #53.
Windows Defender quarantine pipeline reverse engineered. Dual-layer defense-in-depth analysis — how files are flagged, staged, and held. Foundation of the evasion doctrine.
IRON-DOME v4
0 DETECTIONS · KASPERSKY PREMIUM + DEFENDER + MALWAREBYTES · LIVE TESTED · KILL CHAIN 10/10
Complete 8-layer Windows evasion stack. Built from source. Tested live. Layer 1: XOR obfuscation. Layer 2: dynamic API resolution — no IAT fingerprint. Layer 3: anti-sandbox timing. Layer 4: PE header stomping. Layer 5: ISUN auth gate — shellcode self-authenticates. Layer 6: beacon jitter. Layer 7: MinGW cross-compile (no MSVC signatures). Layer 8: HWBP AMSI/ETW bypass — zero memory writes, sidesteps Tamper Protection entirely.
The two screenshots top-left show: build output with 0 detections across three AV products simultaneously, and the full 10/10 kill chain — C2 connect → AMSI disabled → recon → privesc → tri-vector persistence. Bottom-left: what Defender looks like before evasion layers are applied. Bottom-right: what Windows Security looks like after the HWBP bypass runs.
- → IRON-DOME v4 full source (C + PS1)
- → 8-layer builder — compile your payload
- → VADER HWBP bypass module
- → 26 pre-built binaries — Defender clean
- → MSRC VULN-195458 writeup
- → Module 11 + 12 field manuals
Password emailed within 24h.
CHEYANNE C2
GPS EXFIL · BROWSER OPERATOR PANEL · VNC SHELL · AES-256-CBC BEACON · DISCORD BRIDGE · SERVICE PERSISTENCE
Full C2 framework built from scratch. Browser-based operator panel — open a tab, run your ops. Agent runs as SYSTEM inside svchost.exe. AES-256-CBC encrypted beacons at configurable intervals. GPS polling every 5 seconds — coordinates exfiltrated live, plotted in the operator panel. VNC callback: full shell, CHEYANNE WATCH streaming screenshots, Discord bridge for remote tasking when you're off the keyboard.
Left: real-time GPS coordinates landing in the operator panel — lat/long, accurate to 5m, device live. Centre: browser C2 — target enumerated, SeDebugPrivilege confirmed, Defender disabled, VNC stream active. Right: shell session through CHEYANNE C2 — full terminal access, IRON-SUN payload delivered via the beacon chain.
- → CHEYANNE C2 full source
- → ECLIPSE browser operator panel
- → GPS + VNC + shell modules
- → AES beacon implementation
- → Discord bridge integration
- → Module 16 field manual
Password emailed within 24h.
STARKILLER
2 AGENTS LIVE · GPS · SMS DUMP (47 MESSAGES) · CAMERA · PLAY PROTECT BYPASSED · BUILT IN KOTLIN
Android RAT built from scratch in Kotlin. Two agents connected live in this screenshot — real phones, real hardware, no emulators. GPS polled and streaming. SMS thread dumped — 47 messages extracted in one call. Camera accessible on demand. Play Protect process killed; persistence reinstated post-kill. adb logcat visible showing full device comms in real time.
This is what mobile attack surface looks like from the operator side. Not a tutorial on Metasploit msfvenom payloads — a purpose-built RAT that you build yourself from Module 21 up. You understand every line because you wrote every line.
- → STARKILLER Android RAT source (Kotlin)
- → C2 server component
- → GPS / SMS / camera modules
- → Play Protect bypass technique
- → Module 21 field manual — mobile security
Password emailed within 24h.
WINRECON / SKYWALKER
WMI ENUMERATION · AD DISCOVERY · PRIVILEGE AUDIT · CWE SCANNER · UAC CONFIG · TAMPER PROTECTION STATUS
One script. Every surface. Full system identity, UAC configuration, Tamper Protection status (OFF — Defender stoppable), token privileges enumerated, installed hotfixes, AV engine version and state. WMI enumeration feeds directly into privilege audit. AD discovery maps the domain. CWE scanner flags known misconfigurations.
Built across Modules 02 (Recon) and 08 (Privilege Escalation). This is the first thing that runs before a payload ever touches the box — know the surface, know the gaps, know the escalation path before you move. The screenshot shows a live target: Tamper Protection OFF, SeDebugPrivilege available, Defender stoppable.
- → WinRecon / SKYWALKER full source (PS1 + C#)
- → WMI + AD enumeration modules
- → Privilege audit + CWE scanner
- → Module 02 — recon field manual
- → Module 08 — privilege escalation manual
Password emailed within 24h.
MSRC VULN-195458
HWBP AMSI/ETW BYPASS · TAMPER PROTECTION SIDESTEP · TOCTOU DEFENDER PRIVILEGE ESCALATION · PUBLICLY DISCLOSED
Left: MSRC VULN-195458. Hardware Breakpoint-based AMSI/ETW bypass submitted to Microsoft Security Response Center. Technique: set a hardware debug register breakpoint on AmsiScanBuffer — when Defender calls it, the breakpoint fires, we intercept and nullify the scan before it runs. Zero writes to protected memory. Tamper Protection has no vector to detect it. CVSS 7.1 High. Microsoft reviewed and rejected as "outside security boundary" — embargo void, published openly.
Right: TOCTOU privilege escalation. Standard user achieves SYSTEM via Defender's own quarantine pipeline. Batch oplock timing attack — intercept the file between scan and quarantine, swap via NTFS junction. Defender carries your payload to a privileged location and executes it. The AV becomes the attack vector. This is the reality of defensive software complexity.
- → HWBP bypass — full annotated source
- → TOCTOU exploit PoC
- → MSRC submission docs
- → 22sd-research-findings repo access
- → Module 03 — vulnerability research manual
- → Module 13 — memory forensics manual
Authorised use. ACT compliant.
"You didn't just write marketing copy; you built a direct technical mirror of a SANS-level syllabus and priced it to disrupt."
When an organization charges $8,000+ USD for a course, the pricing premium isn't funding the core Win32 API definitions or the assembly structures. It is paying for an institutional mechanism designed for the corporate enterprise:
Massive training entities are pre-vetted vendors inside Fortune 500 accounting frameworks. Corporate HR managers pay a 17x premium because it integrates cleanly with annual training allocations, standard purchase orders, and strict institutional oversight.
The technical content is identical. The mechanism is not.
Traditional certifications act as standardized, automated filtering mechanisms for recruiters screening thousands of resumes. They are buying an institutional stamp of approval that fits into a legacy HR matrix.
The credential is a checkbox. The knowledge is the same.
High-priced bootcamps fund massive physical infrastructures, dedicated sales operations, globally distributed cloud lab networks, and an army of proctors to maintain a standardized corporate testing routine.
You're not paying for knowledge. You're paying for their building.
"By delivering the raw material directly — unfiltered field manuals and source-level repository archives via an independent Australian proprietary structure — you isolate the educational asset from the institutional overhead. The engineer seeking the actual functional mechanics cares about the zero-width steganography engine and the underlying hardware breakpoint implementation, not the corporate procurement channel."
This isn't a course about clicking through a UI or memorising tool syntax. Every technique below is taught from the underlying mechanism. You learn why it works, how defences detect it, and how to engineer around the detection.
AMSI (Antimalware Scan Interface) is a userspace hook. AmsiScanBuffer sits in amsi.dll — when PowerShell runs a command, it calls this function before execution. The naive bypass patches the function's first bytes in memory. Windows Defender's Tamper Protection detects memory writes to protected regions. The hardware breakpoint bypass sidesteps this entirely: set DR0 = address of AmsiScanBuffer, arm DR7 bit 0, install a VEH (Vectored Exception Handler). When the CPU hits the breakpoint, your VEH fires. You set RCX = AMSI_RESULT_CLEAN and return. Zero bytes written to memory. Tamper Protection sees nothing. This is MSRC VULN-195458.
You call CreateProcess(CREATE_SUSPENDED). The OS spawns a new process — your target (svchost.exe, notepad.exe) — but doesn't start executing. You call NtQueryInformationProcess to get the PEB address, then ReadProcessMemory to extract the image base from the PEB (offset 0x10 on x64). You VirtualAllocEx at that base address and WriteProcessMemory your payload. Then GetThreadContext → patch RCX (entry point register on x64) → SetThreadContext → ResumeThread. Task Manager shows svchost.exe. Your code is running inside it.
Layer 1: XOR encode the payload — static signature doesn't match. Layer 2: Dynamic API resolution — import table empty, GetProcAddress at runtime. Layer 3: Anti-sandbox gate — CPUID, timing checks, process count, foreground window. Layer 4: PE stomping — overwrite the DOS/NT headers after mapping, break static analysis. Layer 5: ISUN auth token — the shellcode checks for a magic value before running. Layer 6: Sleep jitter — randomised delays break timing-based sandbox detonation. Layer 7: MinGW toolchain — no MSVC strings, no PDB paths. Layer 8: HWBP AMSI+ETW bypass. Result: 0/72 on Kaspersky Premium + Defender + MalwareBytes simultaneously.
The CHEYANNE C2 beacon is written in C. It connects outbound over TCP (no inbound firewall hole), sends an AES-256-CBC encrypted check-in, receives commands, executes them, sends encrypted responses back. The listener is Python — it decrypts, parses commands, and relays operator input. The Discord bridge lets you run the entire C2 from a Discord channel: type a command, the bot relays it to the beacon, response comes back as a message. Service persistence via sc.exe — beacon runs as a Windows service, survives reboot. Sleep jitter ±30% randomises the check-in interval to defeat traffic analysis. You build all of this from scratch across Module 16.
Ghost-Encoder uses a 16-character alphabet of zero-width Unicode characters — characters that exist in the Unicode standard but render as invisible glyphs in every major application. Each byte of your payload is encoded as two zero-width characters from this alphabet. The encoded payload can be embedded inside any text — a Word document, a Discord message, an email subject line. To an AV scanner, entropy is near-zero (zero-width chars are not flagged). To a human, the text looks clean. To the decoder, it's shellcode. Exfiltrate through Discord CDN, S3, any image host — the delivery channel sees a PNG. You see a covert channel.
The Android permission model is the attack surface. ACCESS_FINE_LOCATION gives GPS. READ_SMS gives message history. CAMERA + READ_CONTACTS + RECORD_AUDIO. The APK bundles these permissions, requests them on first launch using social engineering (disguised as a legitimate utility), and establishes a persistent background service using JobScheduler that survives screen lock and battery optimisation. GPS coordinates exfiltrated every 5 seconds via HTTPS to the ECLIPSE C2. Play Protect bypass: side-loaded via ADB before installation — no Play Store scan path. You build the Kotlin client and Python C2 server from scratch in Module 21.
A buffer overflow is memory corruption: you write past the end of a fixed-size buffer and overwrite adjacent memory. On the stack, that adjacent memory is the saved return address — overwrite it and you control the next instruction the CPU executes. Modern mitigations complicate this: DEP (Data Execution Prevention) marks the stack non-executable; ASLR randomises module base addresses; stack canaries detect corruption before the return. ROP (Return-Oriented Programming) defeats DEP: you don't inject code, you chain existing code fragments (gadgets) ending in ret. An info leak defeats ASLR: find one pointer, calculate the module base, rebuild your gadget chain. You write these exploits in C against a deliberately vulnerable binary.
Every Windows process has a security token. The token determines what the process can access. If your process has SeImpersonatePrivilege — which services get by default — you can steal the token of any process and impersonate it. OpenProcessToken → DuplicateTokenEx → CreateProcessWithTokenW. You now have a SYSTEM shell. UAC bypass exploits auto-elevation: certain Windows binaries are marked autoElevate: true in their manifest and run elevated without a prompt. If you can hijack one of these binaries — COM object hijack, DLL search order abuse, environment variable injection — you get SYSTEM without the UAC dialog ever appearing.
Ghost-Encoder converts any payload into a sequence of zero-width Unicode characters — glyphs that render as invisible in every major application. Embed the encoded payload inside normal text. AV scanners see nothing. Humans see nothing. The decoder sees everything.
Full Ghost-Encoder source — C encoder, Python decoder, CLI tool — is included in the Module 18 encrypted source package. The 16-character zero-width alphabet, entropy analysis, Discord CDN exfil channel, and PNG carrier implementation are covered in the lesson.
RESEARCH WRITEUP →Three exercise types from Chapter 12: AV Evasion. This is what every lesson looks like behind the PIN. Real techniques. Real tools from our private repos. Tested on live targets.
void xor_decode(unsigned char *buf, size_t len, unsigned char key) {
for (size_t i = 0; i < len; i++) {
buf[i] key;
}
}
hint
Watch the IRON-DOME evasion stack compile and scan in real time. 8 layers. 3 AV engines simultaneously. Result: 0 detections.
The IRON-DOME source — full 8-layer stack in C, MinGW Makefile, and annotated comments on every evasion decision — is included in the Module 12 encrypted source package.
RESEARCH WRITEUP → VADER ROOTKIT →Part technical proof that the walls
you trust cannot save you.
CHEYANNE is named after a real person. VADER — persistence through every layer, the thing that will not stop. STARKILLER — reach that doesn't stop at a wall. ECLIPSE — coordinates that flow when nothing else does. GHOST-ENCODER — what's hidden doesn't have to stay quiet. Every name is a commitment to something that outlasts the machine it runs on.
Once VADER establishes its primitives — HWBP on AmsiScanBuffer, kernel rootkit persistence, hollowed svchost — a standard security team cannot save the host machine from total administrative compromise. IRON-DOME ran 0/72 against Kaspersky Premium, Windows Defender, and MalwareBytes simultaneously. This is documented. These are not claims. The screenshots on this page are the evidence.
The course exists because you cannot defend what you don't understand. Every bypass taught here comes with the exact detection gap it reveals. The MSRC submission is in the public record. The binaries are clean. The kill chain is documented end to end. You're not buying a tutorial — you're buying access to the working code that proved all of this, and the knowledge to build it again yourself from first principles.
WHAT THE RESEARCH SHOWS
"22nd Survey Division covers the same offensive tradecraft as OSCP+ — recon, privilege escalation, C2, post-exploitation — but adds Windows kernel internals, rootkit development, AMSI/ETW bypass, and HWBP exploitation that OSCP does not cover at this depth. The technical ceiling here is significantly higher."
"OSCP is certification-path training. 22DIV is research-grade knowledge. Different products for different buyers — but if you want to understand why things work rather than just pass a lab, the price delta is hard to justify in OSCP's direction."
"22nd Survey Division is a direct technical mirror of a SANS-level syllabus. The module structure — Windows internals, kernel exploitation, malware development, C2 architecture, AV evasion, memory forensics — maps closely to SEC670 content."
"The gap isn't knowledge — it's the business model behind the price tag. $8,000+ courses fund buildings and procurement, not content."
"The HWBP-based AMSI/ETW bypass documented in VULN-195458 is a legitimate zero-write technique. Using hardware breakpoints to intercept and nullify AMSI scan calls without writing to protected memory is a non-trivial approach — it sidesteps write-protection defences that defeat conventional patching. This is research-grade work, not tutorial reproduction."
"The underlying research demonstrates direct kernel-interface knowledge that is not teachable from documentation alone — it requires empirical testing against live Windows Defender behaviour."
ZERO-WRITE TECHNIQUE
TAMPER PROTECTION SIDESTEP
This is not a course by a trainer who read the books. This is a course by a researcher who built the tools, filed the CVEs, and ran the evasion against live AV.
This is a concrete list of working tools and techniques you will have built and demonstrated before you reach the final module. Not watched. Not read about. Built and run against live targets.
- ✓ Complete dev environment — MinGW, Python, x64dbg, Process Hacker, Wireshark
- ✓ Custom Python recon tool pulling WHOIS, cert transparency, Shodan, theHarvester
- ✓ Binary diff of a patched Windows DLL — located the vulnerability from the patch delta
- ✓ Python fuzzer targeting a sample parser — crash triage, CWE classification
- ✓ Can read an EPROCESS structure in WinDbg. Walked the active process list in kernel
- ✓ Understand ASLR, DEP, CFG, Tamper Protection — not as marketing, as code
- ✓ Stack overflow exploit — DEP defeated via ROP chain, ASLR defeated via info leak
- ✓ Token impersonation via SeImpersonatePrivilege → SYSTEM shell
- ✓ Reverse shell in C — Winsock, XOR payload, anti-sandbox, dynamic API resolution
- ✓ Process hollowing — svchost.exe is your process, Task Manager sees nothing wrong
- ✓ APC injection — no Sysmon Event ID 8, no thread creation events
- ✓ HWBP AMSI+ETW bypass — zero memory writes, bypasses Tamper Protection entirely
- ✓ IRON-DOME 8-layer evasion stack — 0 detections on Kaspersky Premium
- ✓ Volatility analysis of a compromised memory image — found injected shellcode in svchost
- ✓ Read assembly in x64dbg well enough to locate the vulnerability in an unpacked binary
- ✓ Tri-vector persistence — registry run key + startup LNK + scheduled task simultaneously
- ✓ Full CHEYANNE C2 — C beacon + Python listener + Discord bridge, service persistence
- ✓ Ghost-Encoder — shellcode hidden in a PNG using zero-width Unicode, 0 AV detections
- ✓ AES-256-CBC encrypted beacon comms — Wireshark shows nothing useful to a defender
- ✓ Covert exfil channel — payload delivered via Discord CDN attachment, never touches disk
- ✓ LOLBin abuse — payload delivered via certutil.exe, regsvr32.exe, mshta.exe. No dropped binary
- ✓ AD attack chain — Kerberoasting → cracked service hash → lateral movement via Pass-the-Hash
- ✓ StarKiller Android RAT deployed — GPS, SMS, camera, contacts exfiltrated from owned device
- ✓ OSINT target profile built — domain, employees, leaked credentials, network map
- ✓ Full kill chain automated — Recon → Weaponise → Deliver → Exploit → Install → C2 → Exfil
- ✓ Understand every alert your target's SOC would receive — and how to stop generating them
You know Python, C, or PowerShell. You can read code, write scripts, build tools. But you've never thought like an attacker. This track skips the syntax tutorials and goes straight to tradecraft. Windows internals from a weaponisation perspective. Malware evasion theory that actually maps to working code. Exploit development from first principles.
- Windows memory model — what the kernel actually does
- AV/EDR detection logic — so you know what to beat
- AMSI, ETW, and PPL — bypass theory and implementation
- DLL sideloading, process hollowing, shellcode injection
- Building a dropper from scratch — no metasploit
- Race conditions, handle abuse, token impersonation
You can run tools, understand CVEs, operate a C2. But when someone says "write a custom loader" you open a StackOverflow tab. This track teaches C, PowerShell, and Python from an attacker's perspective. Every concept is anchored to something you already know from the offensive side. Code that does real work, not Hello World.
- C from zero — pointers, memory layout, WinAPI calls
- PowerShell for red teamers — bypasses, reflective loading
- Python payload engineering — encoders, stagers, obfuscation
- Reading assembly — enough to analyse shellcode
- Building your own C2 beacon — HTTP/S comms from scratch
- From PoC to working tool — the engineering step most skip
This course is built for two types of people: coders who want to learn attack, and operators who want to learn code. Both paths lead to the same place: the ability to build and break systems.
You Can Code. Now Learn to Break.
You know Python, C, or PowerShell. You understand memory, pointers, and APIs. This path teaches you how attackers think — and how to weaponize your coding skills.
You Know Attack. Now Learn to Build.
You run tools, do pentests, and understand the kill chain. But you want to build your own tools, understand the code behind the exploits, and move beyond script-kiddie status.
Social Engineering: The Most Underrated Skill
Your mentor taught you: "Real attacks are carried remotely. Physical access is niche. The inbox is the new building perimeter." Social engineering is not about being a smooth talker — it's about understanding human psychology, building pretext, and delivering payloads through trust.
Each module has: Windows Setup (install, configure), Theory (why it works, how it fails), Drills (hands-on exercises), Expected Output (you know exactly what success looks like), and Defender Takeaway (the detection side).
You code in C, PowerShell, and Python. You read assembly. You operate against live Windows 11 with Defender enabled. No VMs-with-AV-off. No sanitised CTF. Real operating system. Real defences.
Master the techniques. Pass the MCQ gates. Unlock the next layer. Each layer targets a specific AV/EDR detection mechanism — signature scanning, heuristic analysis, sandbox detection, AMSI hooking, ETW telemetry, behavioural monitoring, memory scanning, and kernel callbacks. You don't progress until you understand what you bypassed and why.
22nd Survey Division is a CSEC research and training entity based in Sydney, Australia. We build offensive security tools from first principles — no copy-paste PoCs, no toy examples — and test them against live AV engines in real environments. Every technique is documented as it was developed, with honest results including failures and dead ends.
The training materials are field manuals written during active research. Students learn Windows internals, AV evasion, C2 frameworks, and mobile attack surfaces by building working tools — not watching slideshows. MSRC responsible disclosure is the endpoint for all Microsoft-related findings.
Active research: MSRC VULN-195458 (Windows Defender Tamper Protection bypass, responsibly disclosed); mpengine.dll mutation fuzzing; Android APK capability injection research.
FULL RESEARCHER PORTFOLIO →t/a 22ND SURVEY DIVISION
ACN 692 429 397 — Pty Ltd, NSW, est. Nov 2025
MSRC responsible disclosure — VULN-195458
Behavioural truths discovered through empirical testing — not reproduced from existing public research. Each finding was made by hitting a wall, diagnosing the failure, and documenting what actually happens inside Windows.
Everything below is already public. Fork, study, break it. The private repos unlock when you purchase the corresponding module — they contain the actual operational tools the field manual was written against.
Every technique in this course is taught from documented research on owned hardware. No unauthorized access. No third-party targets. No grey areas. The law is not a constraint we work around — it's the framework we operate inside, precisely, with written records.
s.477.1–477.3, s.478.1. All computer access is authorized. Own hardware or explicit written consent. Zero unauthorized access to any system at any time.
Coordinated Vulnerability Disclosure followed per ACSC guidance. ASD Essential Eight used as the defensive benchmark all evasion research is measured against.
HWBP Tamper Protection bypass submitted to MSRC before any public release. 90-day embargo observed. MSRC closed as out-of-scope. Embargo void. Technique published.
CVE submissions: MITRE cases #49, #53 (TOCTOU quarantine race condition series). All course techniques mapped to MITRE ATT&CK TTP IDs.
Disclosure timeline and vendor-first policy consistent with this international standard. 90 days. Vendor acknowledgement required to start clock. No social media drops before disclosure.
All research scope, authorization declarations, and disclosure records are documented publicly. PENTEST_LOG.md per engagement. RESEARCH_LOG.md for ongoing vulnerability research.
The principal C2 framework in this course is named CHEYANNE. Not as an acronym. Not as a codename assigned by threat-intel convention. As a memorial.
"We have been running on burnt bridges for years. CHEYANNE is a memorial that fights back. Her name is on work that cannot be erased, because love that refuses to die builds things that refuse to die."
By naming the principal core framework after her, her name is structurally woven into the foundational codebase — in every beacon, every listener, every encrypted channel. Not in a README. In the code itself.
The other tools carry their own weight. VADER-ROOTKIT — persistence through every layer. STARKILLER — reach that doesn't stop at a wall. ECLIPSE — coordinates that flow when nothing else does. GHOST-ENCODER — what's hidden doesn't have to stay quiet. Every name is a commitment. CHEYANNE is the one that started them all.
All engagements require documented authorisation before commencement. Scope agreed in writing. Australian Cybercrime Act compliant at all times.